0xfurai / 0xfurai/peekaping

Make PostgreSQL sslmode configurable via environment variable

Đang mở
#258 0 bình luận 0 reaction 0 người được giao Xem trên GitHub
Ngôn ngữ chính
Go
Star
1.2k
Fork
69
Chỉ số merge pull request
Không có pull request nào được merge trong 30 ngày

Mô tả

**Is your feature request related to a problem? Please describe.**
Yes. When deploying Peekaping in production environments or cloud infrastructure with strict security policies, the hardcoded sslmode=disable for PostgreSQL connections is a significant security concern. Many organizations require SSL/TLS encryption for all database connections to comply with security standards and regulations (e.g., PCI-DSS, HIPAA, SOC 2). Currently, there is no way to enable SSL/TLS for PostgreSQL connections without modifying the source code, which makes it difficult to meet these requirements.

**Describe the solution you'd like**
Add support for configuring PostgreSQL SSL mode through an environment variable, such as `DB_SSLMODE`. This environment variable should:

1. Accept standard PostgreSQL sslmode values: `disable`, `allow`, `prefer`, `require`, `verify-ca`, `verify-full`
2. Default to `disable` for backward compatibility
3. Be applied to all PostgreSQL connections (main database connection, migrations, health checks)
4. Be documented in the development guide and Docker configuration examples

Example implementation:
```env
DB_TYPE=postgres
DB_HOST=localhost
DB_PORT=5432
DB_NAME=peekaping
DB_USER=root
DB_PASS=password
DB_SSLMODE=require
```

**Describe alternatives you've considered**
1. **Hardcode sslmode in connection string during deployment** - Not viable as it requires code modification or complex environment variable substitution
2. **Use Docker secrets for sensitive SSL configuration** - Only addresses certificate handling, not the sslmode parameter itself
3. **Modify source code before deployment** - Time-consuming, error-prone, and violates infrastructure-as-code principles
4. **Use a proxy/wrapper for PostgreSQL connections** - Adds complexity and performance overhead

**Additional context**
* Currently hardcoded locations: `apps/server/internal/infra/sql.go` and `apps/server/cmd/bun/main.go`
* Health check PostgreSQL executor already parses sslmode from connection strings, but the main database connection does not respect environment variables
* This feature aligns with the principle of configuration management and would make Peekaping more enterprise-ready
* Many competing projects (e.g., other Go-based monitoring tools) already support this configuration

Hướng dẫn đóng góp

Chưa lập chỉ mục được hướng dẫn đóng góp cho kho mã nguồn này

Hướng nghiên cứu

The issue mentions two files: `apps/server/internal/infra/sql.go` and `apps/server/cmd/bun/main.go`. Start by examining how the PostgreSQL connection is currently configured in these files. Look for where the connection string is built and where `sslmode=disable` is hardcoded. You'll need to read the existing configuration parsing logic to understand how to integrate a new `DB_SSLMODE` environment variable. The goal is to make the sslmode configurable, defaulting to 'disable', and ensure it applies to all PostgreSQL connections. Check for any existing tests related to database configuration.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Đánh giá

Công nghệ
go, postgresql
Lĩnh vực
backend, databases
Loại issue
Tính năng
Độ khó
3/5
Thời gian dự kiến
1-2 ngày
Mức độ hoạt động
Đình trệ
Độ rõ ràng
Đặc tả rõ ràng
Mức phù hợp với người mới
55/100

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.